MVP integration: file viewer and durable generation jobs #18

Merged

acbonet merged 5 commits from integration/mvp-ui-generation into main

2026-10-22 19:41:45 +02:00

acbonet commented

2026-10-22 18:53:03 +02:00

Collaborator

Scope

Combines durable generation jobs, polling, progress, cancellation and authenticated job APIs with the latest collaborator file-viewer branch.
Includes feat/file-viewer through 9b3ad0c (existing PR #17); its branch and PR were not modified or merged. This PR intentionally exposes the combined integration for review. PR #17 can be reviewed/landed independently first.
Preserves original-file streaming/editing, DOCX/media viewer, authorization and security headers.

Validation

149 backend tests pass, including original-file endpoint cases.
172 frontend tests pass; Prettier, ESLint, TypeScript and production build pass.
Playwright against compiled UI passes desktop/mobile generation progress, cooperative stop and completed result with no page errors. These are mocked API checks, not real inference.

Coordination and limits

Requires matching RAG generation-job API and running generation worker; do not deploy new job-capable RAG/UI without that worker. Full browser reload does not automatically reattach to an active job.

npm audit reports 3 high production-classified dependency findings (Vite, nanoid, source-map-js); no forced dependency upgrades were applied during integration. They require follow-up triage; Vite is a build tool although listed in dependencies.
Real combined platform CI remains required. No merge or deployment performed.

## Scope - Combines durable generation jobs, polling, progress, cancellation and authenticated job APIs with the latest collaborator file-viewer branch. - Includes feat/file-viewer through 9b3ad0c (existing PR #17); its branch and PR were not modified or merged. This PR intentionally exposes the combined integration for review. PR #17 can be reviewed/landed independently first. - Preserves original-file streaming/editing, DOCX/media viewer, authorization and security headers. ## Validation - 149 backend tests pass, including original-file endpoint cases. - 172 frontend tests pass; Prettier, ESLint, TypeScript and production build pass. - Playwright against compiled UI passes desktop/mobile generation progress, cooperative stop and completed result with no page errors. These are mocked API checks, not real inference. ## Coordination and limits Requires matching RAG generation-job API and running generation worker; do not deploy new job-capable RAG/UI without that worker. Full browser reload does not automatically reattach to an active job. - npm audit reports 3 high production-classified dependency findings (Vite, nanoid, source-map-js); no forced dependency upgrades were applied during integration. They require follow-up triage; Vite is a build tool although listed in dependencies. - Real combined platform CI remains required. No merge or deployment performed.

acbonet added 5 commits

2026-10-22 18:53:05 +02:00

feat: stream and replace a document's original file 8a0c096f60

GET /api/documents/{id}/file streams the upload from RAG for the file viewer, forwarding Range and cache headers so recordings can seek.

Every file gets nosniff and private caching; HTML, SVG and XML also get a sandboxing CSP, so an uploaded page cannot run scripts as whoever opens it. The workspace may come as ?workspace=, since a new tab or a player's src cannot send headers.

PUT replaces an uploaded Markdown or text file, which RAG then indexes again.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat: preview files in the document column

ragoon-ui-ci / validate (pull_request) Failing after 8m37s

Details

6734a3d9ba

Opening a file from Course material, Group files or My files shows it in place of the panels, which stay mounted so folders and search are as they were on return. Back or Escape returns.

PDFs use the browser's viewer, recordings play beside their transcript with each line seeking there, Markdown and text render in place, and DOCX goes through docx-preview, loaded only when needed. Uploaded HTML and rendered Word markup are shown in sandboxed frames so they cannot run scripts.

Notes keep their editor for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

fix: update certifi for a critical advisory

ragoon-ui-ci / validate (pull_request) Successful in 7m16s

Details

9b3ad0ca96

The image scan fails on GHSA-6q48-6c7w-9gw2: certifi 2026.6.17 bundles emSign root CAs whose intermediate keys were compromised. certifi comes in through httpx, so only the lockfile changes, to 2026.10.19.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

feat: integrate durable generation jobs in chat UI bf720a4b3f

Merge remote-tracking branch 'origin/feat/file-viewer' into integration/mvp-ui-generation

ragoon-ui-ci / validate (pull_request) Successful in 8m4s

Details

c445dde826

acbonet merged commit d7cb4b7470 into main

2026-10-22 19:41:45 +02:00

acbonet referenced this pull request from a commit

2026-10-22 19:41:45 +02:00

Merge pull request 'MVP integration: file viewer and durable generation jobs' (#18) from integration/mvp-ui-generation into main